Malicious PDF — malware analysis report

Static analysis result for SHA-256 601867ecfd8614e8…

MALICIOUS

PDF

37.1 KB Created: 2020-08-31 03:00:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd57fcb25982535b387061461336e24f SHA-1: 2696b2575904e7a9f3e51d06655d21a40633e36f SHA-256: 601867ecfd8614e87bc3c1c18d2bf44b5c3b5d6e922c7842ee52779239b57943
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to a malicious URL, disguised as an answer key for a probability worksheet. This URL is associated with known malicious redirector infrastructure. The PDF also contains a large number of links to other PDFs, suggesting a link farm or SEO manipulation tactic. No scripts were extracted, but the presence of embedded links and the ML classifier's high confidence indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=theoretical+and+experimental+probability+worksheet+7th+grade+answers
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static.usrfiles.com/ugd/b8c837_43d352a308e04bdf91c55196a9063abb.pdf
    • https://static.usrfiles.com/ugd/0cd3a8_71902e3e3eb64c1183d2d624b783c1b0.pdf
    • https://static.usrfiles.com/ugd/4e6dd5_d0dec5ba4c0d4dc6a33bb23263336673.pdf
    • https://static.usrfiles.com/ugd/1cc7e8_7d7d646b3b8e40d0af18206617df889d.pdf
    • https://static.usrfiles.com/ugd/726ec9_7a249a8a56ef44a7996e46e277610169.pdf
    • https://static.usrfiles.com/ugd/d9d1f5_2467a92a23ca4be894d341de1b00a7c2.pdf
    • https://static.usrfiles.com/ugd/b8c837_c0490332ced44525988ae3e4ed2cb481.pdf
    • https://static.usrfiles.com/ugd/ddb60a_64a5b41bb03b47f48aeb7b4fe4e4cad9.pdf
    • https://static.usrfiles.com/ugd/b8c837_87d4afba8bcf4aff8f54b9396dfdaab7.pdf
    • https://static.usrfiles.com/ugd/63d3ad_7ea31e813cc148989b7e507cd8876c7c.pdf
    • https://static.usrfiles.com/ugd/87d215_0d8a19ff12b94eaba6c6277154cc370d.pdf
    • https://static.usrfiles.com/ugd/8ba634_f0a15bd712c142a1819077b673daa124.pdf
    • https://static.usrfiles.com/ugd/9cfd0a_1d65bb0415a94df9b851e9688cb9959b.pdf
    • https://static.usrfiles.com/ugd/b8c837_4db56a3895fa4965a81bf66695c320eb.pdf
    • https://static.usrfiles.com/ugd/b8c837_30fd54937558457bb69c065553ce4808.pdf
    • https://static.usrfiles.com/ugd/b8c837_9e4e2a1d621446939847d2da4ef603dc.pdf
    • https://static.usrfiles.com/ugd/79e5df_bbcd3cfd10634d579c1ee6fcfdefa258.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005121.bin
77d8fa69cad5fa1883810c9eb53d2318b3e80b9d38b7d32a48c5a52794ba3567		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5121 5984 bytes
font_01_sfnt_off00006569.bin
5485ae61e90ebb6accadb28e3d451c38a6b6a659eece73eedd89b796c79f3b3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6569 9804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.